Curaçao's gaming regulator — the Curaçao Gaming Authority (CGA), formerly the Gaming Control Board — has permanently shut down its online licensing portal. Operators used the portal to apply and upload documents, and it's where tens of thousands of files leaked from. On October 7, the CGA said the portal won't return to service and that licensing and supervision will run through an interim solution.
What happened
According to the regulator, in December 2025 someone registered an account on the portal under a false identity. Through it, an outsider had access to the system for about nine months, until the CGA detected and shut it down in September 2026.
The access was obtained by German security researcher Lilith Wittmann. She published more than 40,000 documents from the portal. Follow the Money journalists, who went through the archive with European media partners, counted about 800 owners of nearly 650 Curaçao-licensed companies.
According to lawyers who analyzed the leak, the archive includes licence applications, company structures, business plans and personal data of owners and directors: passports, tax returns, addresses and disclosure forms. The CGA itself declines to confirm these figures until its investigation is complete.
Timeline
- December 2025 — an account is created on the portal using someone else's details.
- September 17, 2026 — the CGA reports unauthorized access.
- September 22–23 — the investigation and a public document database are published.
- October 2 — the portal is already offline.
- October 7 — the CGA announces the portal won't return.
- October 9 — the deadline the regulator set for interim solution details. According to Bitcoin.com News, it was missed.
What happens to licences
The CGA says existing licences remain valid and operator obligations are unchanged. But there are caveats:
- Digital seal. The regulator warned that the current digital seal, which casinos use to show their licence on their websites, will be affected. A new verification method is promised "shortly," with no details yet.
- Documents. Operators were asked not to email documents meant for the portal, as other channels can't process them. Portal filing deadlines were postponed.
- Tighter supervision. Lawyers expect the regulator may re-examine applications approved on condition of submitting more documents, and check ownership structures against the leaked data.
What it means for affiliate marketing
Some channels are already writing about mass acquiring freezes, affiliate hold periods extended by 14–30 days and operators fleeing to Anjouan and Kahnawake. None of the sources we checked contain these facts, so for now they're rumors. But there are real risks for anyone running gambling traffic to Curaçao-licensed brands:
- Licence verification may get harder. Ad platforms and payment partners need proof of licence. Until the CGA has a new digital seal, some brands may face delays in moderation and checks.
- Banks and PSPs may get cautious. Lawyers explicitly name the risk that counterparties slow down or reconsider working with brands whose owners appear in the leak.
- Watch your payouts. If an affiliate program starts delaying payouts on Curaçao-licensed offers, ask questions rather than wait.
- Check your offers. A brand's licence can be verified by number on the CGA website, cert.cga.cw, while it's still working.
Curaçao is already going through a major reform: under the new LOK law, old sublicences are being replaced by direct licences. The leak has added chaos to the process, and it looks like the regulator will be tightening the screws in the coming months. We're waiting for the CGA's interim solution details and the new licence verification system.